Receive alert 4 hours later

Comments

3 comments

  • Official comment
    Avatar
    Graham Watts

    Hi There - this is likely a timezone issue. If you navigate to your collector management page (Manage Data > Collection) you will need to correct the syslog source's timezone by adjusting it to the timezone of the physical location those syslog messages are being generated in.

    Here is a screenshot for where to adjust:


    I hope this helps, let us know if you have additional questions here.

    Thanks,

    Graham

  • Avatar
    Anil Baradia

    Even I am facing the same problem regarding time lag even after time zone modification. It is taking 20-30 minutes to reflect the logs in the dashboard. Is this time can be reducible?

  • Avatar
    Graham Watts

    Hey Anil,

    There are many reasons data might be delayed getting to Sumo Logic. What type of log is this?

    Here's a query you can try to see the difference between when the event was generated and when we received it:

    _sourceCategory=<Your_Category_here>

    | ((_receipttime - _messagetime)/1000)/60 as timediffmins
    | timeslice 5m
    | avg(timediffmins) by _timeslice

     

Please sign in to leave a comment.